The QAT VF migration state buffer is allocated with kmalloc(), while qat_vf_save_state() exposes all state_size bytes to userspace. The state manager writes only the serialized sections, leaving the unused tail unchanged. The first save can therefore disclose stale heap contents, and subsequent saves can disclose data left by an earlier migration. Zero the whole buffer before writing the setup data. Once the setup data is present, preserve it and zero the remaining state area before each state save. Fixes: f0bbfc391aa7 ("crypto: qat - implement interface for live migration") Cc: stable@vger.kernel.org Assisted-by: Claude:claude-fable-5 Signed-off-by: Karl Mehltretter --- Found by review. Compile-tested only; I do not have QAT hardware available. Changes since RFC: - Drop the RFC tag and mark the patch ready for application. - Describe the concrete userspace exposure path and add Cc: stable. - No code changes. RFC: https://lore.kernel.org/r/20260817042613.19855-1-kmehltretter@gmail.com/ drivers/crypto/intel/qat/qat_common/adf_gen4_vf_mig.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/drivers/crypto/intel/qat/qat_common/adf_gen4_vf_mig.c b/drivers/crypto/intel/qat/qat_common/adf_gen4_vf_mig.c index bf2bae78a40d5..d8b961b2f2f7f 100644 --- a/drivers/crypto/intel/qat/qat_common/adf_gen4_vf_mig.c +++ b/drivers/crypto/intel/qat/qat_common/adf_gen4_vf_mig.c @@ -837,6 +837,9 @@ static int adf_gen4_vfmig_save_state(struct qat_mig_dev *mdev) return ret; } + memset(mdev->state + mdev->setup_size, 0, + mdev->state_size - mdev->setup_size); + adf_mstate_mgr_init(vfmig->mstate_mgr, mdev->state + mdev->setup_size, mdev->state_size - mdev->setup_size); if (!adf_mstate_preamble_add(vfmig->mstate_mgr)) @@ -934,6 +937,8 @@ static int adf_gen4_vfmig_save_setup(struct qat_mig_dev *mdev) if (mdev->setup_size) return 0; + memset(mdev->state, 0, mdev->state_size); + adf_mstate_mgr_init(vfmig->mstate_mgr, mdev->state, mdev->state_size); if (!adf_mstate_preamble_add(vfmig->mstate_mgr)) return -EINVAL; -- 2.53.0